High CPU usage for auditbeat

[adrisr (Adrian Serrano)]

You can see for example using htop -p $(pidof auditbeat).

Anyway, I suggest you try the custom 7.8.0 snapshot build in this post:

Auditbeat - 120% CPU?

@ethrbunny @btnrsec @stefws @hazardousmonk @mgotechlock @BenB196 We've identified the issue with 7.8.0 and have a fix PR. Here's a snapshot build of 7.8.1 with the fix in the above PR: https://drive.google.com/drive/folders/1V704wdgKaIKCci0aO1Bao8COAHhjKotp?usp=sharing Can you give it a try (with socket dataset enabled) and share the outcome? Thanks

If it solves the problem, this fix will be released in the upcoming 7.8.1